jyamajala158838 (Community Member) asked a question.
Hi Team
I am trying to perform agent based scan using Jenkins CI. However, I see the below errors. Can you please help resolve the error to get a complete scan.
I am trying to perform agent based scan using Jenkins CI. However, I see the below errors. Can you please help resolve the error to get a complete scan.
16:27:59 WARNING: SourceClear has not validated support of amzn version 2018.03
16:28:01
16:28:01 No supported build system found. Please see our list of supported systems at h_ttps://w_ww.sourceclear.com/docs/frequently-asked-questions
.png){kind=logo}
Hello @jyamajala158838 (Community Member),
This error message means that SCA was unable to to find a relevant package manager to scan with. You can find the documentation for what we support at the following page on the Help Center:
Languages and Package Managers: https://help.veracode.com/reader/hHHR3gv0wYc2WbCclECf_A/KE~E8K7VbuChm5B8tVqiIQ
Please let me know if the documentation helps!
Could you please help me understand the exact steps Sourceclear is looking for in a Jenkins Job?
1. How will SourceClear find the package manager and perform the scan?
2. How will SourceClear detect the Ant installation (we currently are using Ant)?
3. Will SourceClear require complete code compilation before the command is invoked curl -sSL https://download.sourceclear.com/ci.sh | sh
4. Or does SourceClear only require the sourcecode location and will be able to scan by compiling the code in itself if the necessary Ant installation is known?
I have followed the steps as mentioned for Jenkins CI in the help page. I followed all the steps to include secret test and added the curl command in execute shell step, however the job fails. I hope understanding the working and detailed steps to be configured in job will resolve the issue.
Configure your Veracode Agent-Based Scan Jenkins Job
1. Select the job you want to scan.
2. Click Configure.
3. Click the Build Environment tab.
4. Select Use secret text(s) or file(s).
5. Under Bindings, select Add > Secret text.
6. For Variable, enter SRCCLR_API_TOKEN.
7. Select SRCCLR_API_TOKEN.
8. In the build section, select Add build step > Execute shell.
Note: You can include the shell as a pre- or post-build step.
1. Add the following command to the shell command box:
curl -sSL https://download.sourceclear.com/ci.sh | sh
1. Save your build.
The next time your job runs, Veracode Agent-Based Scan performs a scan.
Thanks,
Jyothi
Hello Jyothi,
The SCA scanner uses a combination of package manager files and JAR identification. It does not locate a local package manager or installation, as the code must be properly compiled and prepared ahead of time.
Please ensure that you are following the 'Ant Requirements' section of the following Help Center article: https://help.veracode.com/reader/hHHR3gv0wYc2WbCclECf_A/vOE3CrKwJKKD0qruspk_gg
Let me know if this additional information helps, or if you're still having trouble. If it's still not working, please include any additional error logs, as we may have to reach out to our Support team for troubleshooting.
However, we have a part of code which uses “Maven”.
After mvn clean install – the output is a single jar file.
When we point sourceclear to the jar it says “No open source libraries identified”.
Alternatively, when we provide export CUSTOM_MAVEN_COMMAND=”clean install <path>/pom.xml” we are getting below error and scan is failing.
SourceClear found no library dependencies.
Please ensure that the project contains at least one dependency to perform a scan.
Can you please let us know if we are missing any step or making any mistakes. Thanks a lot for your help.
Thanks,
Jyothi
Were you able to check the below error and can you provide any inputs on how to resolve the issue.
Thanks,
Jyothi